← WebKit Silent-Fix Report — 2026-W22
18a2c9a100 replaceAllWithCacheUsingRegExpSearchThreeArguments fails to throw exception in string resolution
severity medium
class Other
confidence 0.55
JSC StringPrototype
Primitive: execution continues with pending exception during replacement string resolution
Triage note: Adds RETURN_IF_EXCEPTION after resolving a replacement string, avoiding continued execution with a pending exception.
Triage note: Adds RETURN_IF_EXCEPTION after resolving a replacement string, avoiding continued execution with a pending exception.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…